Skillv1.0.0

ClawScan security

tqsdk · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 16, 2026, 6:39 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only TqSdk help skill that is internally consistent: it contains repository-backed references and examples, requires no installs or credentials, and does not request or install anything disproportionate to its stated purpose.
Guidance: This is an instruction-only, documentation-backed helper for TqSdk and appears coherent and proportionate. Before enabling or invoking: (1) note that example code includes placeholders for TqAuth (account/password) — do not paste real credentials into the chat; provide credentials only when running code in a trusted local environment; (2) the skill will not install software or access your system, but if you ask it to produce runnable scripts you will need to run them locally or on your own servers (and supply any required credentials there); (3) if you need the agent to run code against live accounts, consider limiting permissions or using a simulated account (TqSim/TqKq) first; (4) if you want extra assurance, inspect the reference files yourself (they are included) to confirm there are no unexpected network endpoints or commands.

Purpose & Capability: okThe name/description (TqSdk help, examples, and debugging) matches the SKILL.md and the included reference files. No unrelated binaries, env vars, or config paths are requested and the document set is proportional to the stated purpose.
Instruction Scope: okSKILL.md directs the agent to read specific repository reference files and to answer using those docs and small runnable snippets. It does not instruct the agent to read arbitrary system files, network endpoints, or to exfiltrate data. The examples show placeholders for TqAuth credentials, but the skill does not direct the agent to collect or transmit secrets.
Install Mechanism: okNo install spec or downloaded code — instruction-only skill. Nothing will be written to disk or installed by the skill itself.
Credentials: noteThe skill declares no required environment variables or credentials, which is appropriate. Many example snippets show TqAuth("account","password") placeholders; users should be careful not to paste real credentials into chat. The skill itself does not request or store secrets.
Persistence & Privilege: okalways is false and the skill has no install or persistence behavior. The skill does not modify other skills or request system-level privileges.